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REMARKS 

Claims 1-37 arc pending, with claims 1,17, 24, and 36 being indcpcndem. Claims 6 and 
37 have been cancelled by this amendment without prejudice. Claims I, I2» and 36 have been 
amended. No new mailer has been added. Reconsidcralion and allowance ofthc above- 
referenced application arc rcspectftiUy requested. 

Allowable Subjec t Matter: 

The indication of allowable subject matter in claims 22, 25, 27-29, 31-35, and 37 is 
acknowledged and appreciated. The claims are retained, and the riglu lo rcvvriic these claims in 
independent fomi al a later dale is reserved- 
Claims 12-15 are not addressed by the Office Action. Claim 12 should be allowable at 
least for the same reason as claim 22. Claim 1 2 has been amended to be in independent form. 
Claims 13-16 depend from claim 12, and the rejection ofclaim 16 under 35 U.S.C. § 112 is 
addressed below. Thus, claims 12-16 should be in condition for allowance. 

Intervie w Summ>irv: 

Examiner Kaushikkumar M, Patcl is thanked for the interview, which was conducted 
with Applicant's representative, Mr. Hunter, on April 20, 2006. During the interview, claims 1 
and 12, ond the Purycar reference (TJ.S, Pat. App. No. 2006/0005201) were discussed. No 
substantive arguments were presented as Applicant's representative was attempting to 
understand the logic underlying the current OfTicc Action, and Examiner Patcl (who was only 
recently assigned to this case) was only partially familiar with the Office Action. The proper 
scope of statutory subject matter was briefly discussed. Also, Mr. Hunter asked that Examiner 
Pate! make the Puryear reference officially of record by supplying a substitute 892 fonm. No 
agreement was reached. 
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Ktficction Unde r 35 U. S.C. $ 101: 

Claim 1 stands rejecied under 35 U.S.C. § 101 as allegedly being directed to noiv 
statutory subject matter. This contention is respectfully traversed. 

The Office Action £is$cits that the present specification defines a machine-readable 
medium in Ij 18 as non-statulory subject matter, and then Jitaies, "Software products, computer 
program products and machine-readable signals are not patentable subject matter/' (Se*^ Office 
Action at page 2.) Mrst, attention is called to the actual language of the present specification: 
As used herein, the term "machine-readable medium'' refers to any software 
product, computer program product, apparatus and/or device used to provide 
machine instructions and/or data to the machine 100, in cluding a machine- 
reada ble meilium that receives machine in st ructions as a machinc-re «i dablc siunaL 
Examples of a machine-readable medium include the medium 135 and the 
memory 1 20, llic icnn "machine-readable signal*' refers to any signal, such as 
tiic signals 1 54, used to provide machine instructions and/or data to the machine 
1 00. The term "storage device" refers to any appanUuii having a tnachinc- 
readable medium suitable for prolonged storage of data and/or code, 
(See Spccifjcalion at 1 8; emphasis added.) As clearly indicated above, ^\ 18 does not define a 
machine-readable medium as including a machine-readable signal, but rather as including a 
machine-readable medium that receives machine instructions as a machine-readable signal. 

Second, there is no basis for asserting that software producls and computer program 
products arepcrse non-statutory. Attention is called to claim 26 of issued U.S. Patent No. 
6.526,523 to Chen (cited by the Examiner in the Office Action) which is directed to a computer 
program. Moreover, numerous issued U.S. Patents include claims directed to computer program 
products and software products. Examples ofsuch U.S. Patents can be provided upon request. 

The Examination Guidelines for Computer- Related Inventions, as set forth in MPEP 
2106, make clear that, ''a claimed computer-rcadablc medium encoded wiih a computer program 
is a computer element which defines structural and functional interrelationships between the 
computer program and the rest of the computer which permit the computer program's 
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functionalityto be realized i;...] is [,..] statutoiy/' MPEP2 106 JV.B. 1(a),) Claim I clearly 
falls within tiiis category of statutory subject mailer 

Iji addition, claim I reads as follows: "An article comprising a machine-readablc medium 
embodying infomiation indicative of instructions that when performed by one or more machines 
result in operations comprising: Section 101 of title 35. United Stales Code, provides: 

''Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new aJid useful improvement thcreoi; may obtain a patent therefor, 
subject to the conditions and requirements of this title/' An article comprising a machine- 
readable medium, as claimed, is clearly a new and useful manuiacture or improvement thereof. 
"In choosing such expansive terms as 'manufacture' and 'composition of matter/ modified by 
the comprehensive 'any/ Congress plainly contemplated that the patent laws would be given 
wide scope. The relevant legislative history also supports a broad cotistruction.*' (S&e MPEP 
2106(!V){A). citing Jn Chakrabarty, 447 U.S, at 308-309, 206 IJSPQ at 197.) The plain 
language of claim 1 , read in view of the specification, clearly defines a new and useful 
manufacture, which causes one or more machines to perform operations that provide utility in a 
real-world context. Hence this claim is cleaily lijnited to a practical application tn the 
teclmological arts, ;ind as such, represents statutory subject matter (See MPEP 
2106(IV)(B)(2)(b)(ii).) 

Moreover, the Office Action's failure to provide any authority for the 35 U.S.C. § 10] 
rejection makes the rejection clearly deficient. Attention is called to the fact that the 
Examination Guidelines for Computer-Related inventions, as set forth in MPEP 2106, ''do not 
constitute substantive rule-making and hence do not have the force and effect of law. These 
Guidelines have been designed to assist Office personnel in analyzing claimed subject matter for 
compliance with substantive law. Rejections will be based up on the substantive law and it is 
these rejections which are appealable," (.SV*? MPEP 2106(1); emphasis added.) In the current 
Office Action, no citations to the substantive law have been provided in support of the rejection 
under 35 U,S.C. § 101 . and thus this rejection is clearly deficient. Tn view of the above, 
withdrawal of ihc rejection under 35 U.S.C. § 101 is respectfully requested. 
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Rek ctiori Under 35_ILS.C. S 1 12: 

Claims 1,16, 23, and 30 suind rejected under 35 U.S.C. § 1 1.2, second paragraph, as 
allegedly being mdcrinile. This coiueiuion is respcclfully traversed. 

With respect lo claim 1 , the Office Action asserts that the term •Inlbrmation indicative of 
inslructioas" has unclear meaning, (See Office Action at page 3,) This language should be clear 
to one skilled in the field. Nonetheless, in order to expedite prosecution, Uie preamble of claim 1 
has been amended lo delete the words "information indicative of", nuis, withdrawal of the 
rejection of claim 1 under 35 U.S.C. § 1 12 is respectfully requested. 

With respect to claims 1 6, 23, and 30, the specification clearly provides a standard for 
ascertaining the meaning of the phrase *^^maJl packet'^ such that one of ordinaiy skill in the art 
would be reasonably apprised of the scope of the claimed subject matter. The specification 
clearly slates, **Small packei^; can be used to reduce transmission and processing latencies, 
resulting in better performance for live analysis." (See Spccillcaiion at 1| 36.) The spccilicaiion 
then goes on to provide a very detailed example packet structure that can be used cfBcicntly over 
multiple transports. (See Specification at fs 36-50 and Figs. 6-24.) In view of the provided 
detailed example of the claimed ''small packets", claims 16, 23, and 30 are definite as written. 
Thus, withdrawal of the rejection of claims 10, 23, and 30 under 35 U,S,C. § 112 is respectfully 
requested. 

Reiection U nd er 35 U.S.C- ^ 102: 

Claims I, 3-6, 8-10, and 36 stand rejected under 35 U.S.C 102(b) as allegedly being 
anticipateti by U.S. Pre-Granl Publicaiion 2002/0133702 (Stevens). This contention is 
respectfully traversed. 

Independent claim 1 has been amended to include the feature of cancelled claim 6. Tlius, 
claim 1 now recites, "determining whether a storage device, in a data processing system running 
an operating system, includes a protected area, Qic operating system including a liardware 
abstraction layer; removing the storage area protection of the storage device from within the 
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running operating .system and wilhout rebooting the daia processing system; and providing 
information derived from the formerly protected .storage area to a data processing system 
detection (t^ol; wherein said determining and said removing occur in a kernel mode of the data 
processing system;^ As described in a detailed extiinple in the specification: 

The OS 220 can include a kernel that handles memory management, process 
and task management, and disk management. [...] 

To assist law enforcement and infonnalion security personnel in determiining 
if a user has utilised the protected area 212 to hide contraband or malware, a 
kernel-mode software module 230 can be used to provide access to the protected 
arcii 212 and enable live imaging and analysis of the protected area 212 from 
wilhin the running operating system 220 and without rebooting the data 
processing system 200. f . . . | 

The kernel-mode software module 230 can be a device driver (e.g., a 
Windows Driver Model (WDM) driver). The software module 230 can be loaded 
into memory by a detection application 240, and the software module 230 can 
provide a detection tool with access to the protected area 212. | . . . ] 

Thus, ihe software module 230 and the detection apphcalion 240 can provide 
direct and live access to the protected storage area 212 in order to image or 
analyze the protected storage area 212 in support of some detection fimction. The 
software module 230 ajid the detection application 240 enable direct access to the 
protected storage area live from the high level operating system without the need 
to reboot. In effect^ (he kernel-mode software module 230 operates as a broker 
for the detection application 240, providing direct hardware access to the user- 
mode application dcsspite the hardware abstraction layer 222. Moreover, the 
removal of the protected storage area 212 {i.e., the removal of the protection) can 
be done volatilcly so the protection can be restored by the next system reboot, 
leaving the storage device 21 0 unahcrcd. 
(See Spccilicaiion at ^s 1 9, 2 1 , 22, and 23; and Fig. 2.) 
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In conlriist, Stevensi describes methods Ibr gnmiing access to a protected arcfl, siich as a 
hard disk drive ofa computer, after the cotnpulcr has been booted, by introducing BIOS (Basic 
InpLit/Output System) modules that maybe accessed after the computer is in normal operation. 
(See e.g,. Stevens at 8-9, 19. 45-46, 48^49, aiKl 53.) Stevens* use of BIOS modules is very 
different tliiui the use of a kernel mode of a data processing system, as is readily understood by 
those skilled in the art. 

In the rejection of claim 6, the Office Action asserts that, "it is inherent to the system 
disclosed by Stevens that these processes occur in kernel-mode because accessing hardware 
communicalivcly attached lo the processing system requires tlic use of the drivers loaded into the 
kernel of the operating system/^ {Sec Oftlcc Action at page 5,) This assertion is incorrect, as 
Stevens clearly describes the use of BIOS modules, not a driver loaded into the kemel of the 
operating system. The Office Action fails to providing any rationale or evidence to support its 
assertion of inherency, as is required. {See MPEP 21 12.TV0 I hus, in view of the above, 
independent claim I should be in condition for allowance. 

Dependent claims 3-S» 7, and 8-10 sliould be patentable based on the above arguments 
and the additional recitations they contain. For example, the subject matter of claim 7 is not 
even addressed in Uic current Office Action. Additionally, the subject matter of claims 8 and U) 
is not adequately addressed in the current Office Action. 

Claim 8 recites, ''scanning ihc formerly protected storage area; and identifying file 
system information in the formerly protected storage area/' Claim 10 recites, "^wherein the 
operations further comprise reconstructing a file system of the fonncrly protected storage urea to 
derive the information." Kor both of these claims, the Office Action merely refers to ^ 8 1 of 
Stevens, which states, "The directory function returns a list of available services by filling a 
buffer provided by the calling apphcation or process.'' As clearly described in Stevens, the 
"directory function" is retrieve service area directory function.'' {Sec e.g., Steven at 1 5 and 
69-70,) Thus, the directory function of Stevens does not anticipate the subject matter of claims 8 
and 10. 
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Fin;UJy, independent claim 36 luis been impended lo include the allowable subject mailer 
of claim 37, Thus, claim 36 is in condition for allowance. 

Rejections U nder 35 IJ,SX:. § 1 03: 

Claim 2 m^mds rejected under 35 IJ.S.C. § 1 03(a) as allegedly being unpatentable over 
Stevens in view of U.S. Pre-Grant Publication 2005/0262342 (Field). Claim 1 1 stands rejected 
under 35 U.S.C. § 103(a) as allegedly being unpatentable over Stcvtms in view of U.S. Prc-Grant 
Publication 2005/0193 1 1 5 (Chellis el al.). Tliesc conlenlions are respcctfuHy traversed. 

Claims 2 and 1 1 depend from an allowable base claim for the reasons addressed above. 
Thus, claims 2 and 1 1 should be in condition for allowance for at least this reason. In addition, 
with respect to claim 1 1, a prima facie case of obviousness has not been eslablishcil, because the 
feature of claim 1 1 ("wherein providing the information derived from the fonnerly protected 
storage area further comprises selecting the transport medium from a group including a 
peripheral device interface medium and a network comniunications medium") is not present in 
Chellis, and the cited portion of Chellis (1| 84) does not provide a motivation lo combine Cheliis 
with Stevens, Thus, claims 2 and 1 1 should be in condition tor allowance. 

Claims 17-20, 24, and 26 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Stevens in view of U.S. Pre-Grant Publication 2006/005201 (Purycar). Claim 
21 stands rejected under 35 U.S.C. § 1 03(a) as allegedly being unpatentable over Stevens in 
view of Purycar and U.S. Prc-Granl Publication 2002/0133714 (Sales). These contentions are 
respectfully traversed. 

Independent claim 1 7 recites, ^loading a kernel-mode software module in a computing 
system running an operating system; and without rebooting the computing system, using the 
kcmcl-modc software module to perform operations from vvitiiin the operating system, the 
operations comprising detcmiining whether a storage device in the computing system includes a 
protected area, and reversibly removing the storage area protection.'' For the reasons addressed 
above in connection with claim I, Stevens does not teach using a kcrncUmode software module 
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to perform opcralions from within m operating system as claimed. Thus, claim 1 7 should be in 
condilion for allowance for at least Ihis reason. 

In addition, n prima facie case of obviousness has not been established btjcause no 
molivadon to combine Purycar with Stevens has been provided. Puryear describes, "An 
extensible kernel-niodc audio (e.g., MIDI) processing architecture is impicrncnled using multiple 
modules that together comprise a module graph. The modulo graph is implemented in kernel- 
mode, reducing latency and jitter when handling audio data by avoiding transfers of the audio 
data to user-mode applications for processing," See Puryear at Abstract. Since Puryear is 
directed to an entirely different technical problem than Stevens, and since no evidence of a 
motivation to combine Puryear with Stevens has been provided^ a prima facie case of 
obviousness has not been established. 

In order to establish a prima facie case of obviousness under 35 U.S.C\ § 103(a), the 
Examiner must provide particular fmdings as to why the two pieces of prior art are combinable, 
.Ste ni reDembiczuK 175 F.3d 994, 999, 50 USPQ 2d 1614, 1617 (Fed. Cir, 1999). Broad 
conclusory slalements standing alone are not evidence . Combining prior art references without 
evidence of such a suggestion, teaching, or motivation simply takes the inventor's disclosure as a 
blueprint for piecing together Uie prior art to defeat patentability-ihe essence of hindsight 
reconstruction. See In re Dembiczak, 50 USPQ2d at 1617. Attention is called to /n re Lee, 277 
F.3d 1338 (Fed. Cir. 2002), in which the Federal Circuit vacated a Patent OITice Board 
affirmance of an obviousness rejection because, rather than relying on objective evidence, the 
Patent Office based its obviousness rejection on conclusory slalements having no evidentiary 
support in the record. Id. at 1342-43. In doing so, the Federal Circuit made it abundantly clear 
that ^'subjeciive belief and unknown authority" and "(assertions ofj common knowledge and 
common sense" are not "a substitute for evidence." Id at 1 343-44. 

In view of the above, independent claim 1 7 should be in condition for allowance. 
Dependent claims 18-21 should be patentable based on the above arguments and the additional 
recitations they contain. For example, with respect to claim 21 , a prima facie case of 
obviousness has not been established, because the feature of claim 21 ("sending information 
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derived from Ihc Ibmicrly prolectcd storage area over a selected transport medium lo a data 
processing .system detection toor') is not present in Sales, and the cited portion of Sales (1| 31) 
does not provide a motivation to combine Sales with Stevens. 

Independent elaim 24 recites, "a data processing system detection tool; atid a kernel- 
mode software module operable to provide the detection tool with access to a prolectcd area of a 
storage device in a data processing system when the keme^modc software motUde is loaded into 
Uie data processing system." Based on the above arguments, independent claim 24 should be in 
condition for allowance. Dependent claim 26 should be patentable based at least upon the above 
arguments. 

Conclusion 

ft is believed that all of the pcndinfi claims have been addressed. However, the absence 
of a reply to a specific issue or comment does nol signify agreement with or concession of that 
issue or comment. Because the arguments made above may not be exhaustive, there may be 
reasons for pateniabilily of any or all pending claims (or other claims) that have not been 
expressed. Finally, nothing in tl)is paper should be construed as an intent to conce<le any Issue 
with regard to £my claim, except as specifically staled in this paper, and the amendment of any 
claim does nol necessarily signify concession of unpatentability of ibe claim prior to its 
amendment. 

It is respectfully suggested for all of these reasons, that the current rejections arc 
overcome, that none of the cited art leaches or suggests the features which are claimed, and 
therefore that all of these claims should be in condition for allowance. A fomia! notice of 
allowance is thus respectfully requested. 
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Please a)7ply the cxii a independent claim tcc» and any other necessary charges or credits 
to deposit account 06-1050. 

Respectfully submitted. 
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